JP2000339274A - Terminal system, authentication method and external storage device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To effectively prevent illegal use of a terminal device by a third party without deteriorating convenience of the terminal device by a regular user. SOLUTION: An accessible terminal device is stored in an external storage means in advance as authentication information DATAx based on terminal equipment information IDx peculiar to the terminal device, and the terminal device is set to an accessible condition when the external storage device where the authentication information DATAx are stored is connected to a terminal device corresponding to the authentication information DATAx. Thus, when the terminal device and the external storage means which have an authentication history for each other are connected, a user can easily utilize the terminal device without the need of troublesome authentication processing accompanied with the password input.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a terminal system, an authentication method, and an external storage device, and more particularly to a terminal system, an authentication method, and an external storage device that can effectively prevent unauthorized use of a terminal device by a third party. It is something.

[0002]

2. Description of the Related Art Conventionally, in a terminal device connected to a server via a network, an authorized user of the terminal device inputs a predetermined password to the terminal device when using the terminal device. By doing
Authentication is performed with a terminal device, and permission to use the terminal device is obtained.

[0003] The terminal device performs authentication in this way to prevent a third party from freely using the terminal device.

[0004]

However, when a third party who has learned the password inputs the password into the terminal device, a third party can use the terminal device. There is a problem that the information providing means such as a server can be freely accessed on behalf of the user.

[0005] In addition, a legitimate user of the terminal device has to perform a complicated authentication process involving input of a password every time the terminal device is used, and there is a problem that the usability of the terminal device is poor.

[0006] The present invention has been made in view of the above points, and a terminal system and an authentication system capable of effectively preventing unauthorized use of a terminal device by a third party without deteriorating the usability of the terminal device by an authorized user. A method and an external storage device are proposed.

[0007]

In order to solve this problem, according to the present invention, an available terminal device is stored in advance in external storage means as authentication information based on terminal device information unique to the terminal device. The authentication information is stored by setting the terminal device to an available state based on the authentication information stored in the external storage means when the external storage means storing the authentication information is connected to the terminal device corresponding to the authentication information. When the user who owns the external storage device connects the external storage device to the terminal device associated with the authentication information, the terminal device becomes available, and unauthorized use of the terminal device by a third party can be prevented. At this time, the terminal device can be used based on the authentication information stored in the external storage means, so that the authorized user can easily use the terminal device without performing a complicated authentication process involving input of a password. can do.

[0008]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below in detail with reference to the drawings.

In FIG. 1, reference numeral 10 denotes a network system as a whole, and personal computers 11 and 12, which are terminal devices, are connected to a network 20. Each of the personal computers 11 and 12 can access the server 21 via the network 20, and a user operating each personal computer 11 or 12 can access the server 21 from the server 21 via the network 2.
0 can receive desired information.

The personal computer 11 constitutes a terminal system 10A together with a memory card 30 as external storage means which is detachable from the personal computer 11, and the personal computer 11 stores the memory card 30 uniquely owned by the user via a connection adapter 11D. By connecting to the computer 11, the user can use the personal computer 11.

The personal computer 12 has a slot 12D for connecting a memory card 30 as external storage means which is detachable from the personal computer 12.
The memory card 30 uniquely owned by the user is connected to the personal computer 12 via the connection adapter 12D.
The user can use the personal computer 12 by connecting to.

As shown in FIG. 2, a memory card 30 connected to the personal computer 11 or 12 is connected to a connection adapter (memory card interface 11D) of the personal computer 11 or a slot (memory card interface 12D) of the personal computer 12.
D) and a ROM (R) connected to the connector 30B via the bus BUS.
ead Only Memory) 30C and RAM (Random Access Mem)
ory) 30D and a CPU (Central Process) that executes a predetermined process by a program stored in the ROM 30C.
ssing Unit) 30A.

The RAM 30D stores various information unique to the user who owns the memory card 30 in an area designated by the address shown in FIG. That is, in the storage area of the RAM 30D, the first area A
R11 connects a terminal device (such as a personal computer 11 or 12) connecting the memory card 30D to the network 2;
0 is an area for storing network connection information for connecting to a terminal device (such as a personal computer 11 or 12) for receiving use registration (authentication) from the server 21 when the memory card 30 is connected to a terminal device (such as the personal computer 11 or 12). The card ID (Identification) is registered in advance.

The second area AR12 of the RAM 30D
Is an area for storing additional information that is downloaded when receiving various services (such as information provision) from the server 21 using a terminal device (such as the personal computer 11 or 12) to which the memory card 30 is connected. is there.

The third area AR13 of the RAM 30D
Is an area for storing information uniquely used by the user who owns the memory card 30, such as an address book or schedule data, and a password uniquely assigned to the user. The password is encrypted using, for example, the MD5 encryption method and is stored in the third area in advance, and the user who owns the memory card 30 recognizes the password in advance.

The fourth area AR14 of the RAM 30D
Is an area for storing information usable for each terminal device to which the memory card 30 is connected. For example, a television program used when the terminal device to be connected is a television device (not shown) WW for list or TV program
URL (Unifo) for viewing explanations on W (World Wide Web)
rm Resource Locator) information, the terminal device to which the memory card 30 is connected is the personal computer 11 or 1
2, a text being edited or read or written, a screen or a program under development, or a terminal device to which the memory card 30 is connected is a mobile phone (not shown) or a pager (registered trademark) (not shown) In this case, data and the like of the character mail service transmitted / received are stored.

The fifth area AR15 of the RAM 30D
Means that the user can store the memory card 30 in various terminal devices (personal computers 11, 12 or other terminal devices)
This is an area for storing authentication history information D15 (equipment ID (IDx) and numerical value (DATAx) described later) indicating the authentication history between the memory card 30 and the terminal device, which is recorded at the time of first connection to the device.

As described above, the password and the authentication history information unique to the user who owns the memory card 30 are stored in the memory card 30,
Is connected to the terminal device, the memory card 30
Based on the authentication history information stored in the fifth area of M30D, it is determined whether or not the terminal device connected at this time is a terminal device having a history of connection in the past.

That is, as shown in FIG. 4, a personal computer 11 as a first terminal device has a CPU 11
A, RAM (Random Access Memory) 11B, ROM (Rea
d Only Memory) 11C, a memory card (MC) interface (INF) 11D for exchanging data with the memory card 30, an interface processing unit 11J, a communication interface 11E for exchanging data with the network 20, a liquid crystal display panel (VRAM) 11F storing characters and graphics corresponding to data to be displayed on a display unit 11G such as a VRAM (Video RAM) 11F, and a signal input by a user operating an input unit 11H such as a keyboard or a mouse. The input interface (INF) 11I to be transmitted to the CPU 11A is connected to the data bus BUS.
It is connected to the.

The CPU 11A executes various operations in accordance with operation programs stored in the ROM 11C, and controls each circuit in accordance with the operations. The CPU 11A displays various processing contents on the display unit 11G.

Here, for example, when the user operates the personal computer 11 and inserts the memory card 30 owned by the user into a memory card slot (not shown), the detection contact of the memory card 30 is changed. By being connected to the contact point of the memory card interface 11D, the interface processing unit 11J detects a change in the signal level for detecting the memory card (change from the logical “L” level to the logical “H” level).
An interrupt process is performed by sending an interrupt signal to U11A. Thereby, the CPU 11A detects that the memory card 30 has been inserted. Incidentally, the interface processing unit 11J is a processing block for performing a protocol process in accordance with the interface specification when transferring data to and from the memory card 30. As a result, the interface processing unit 11J
Is ready to read the user-specific information stored in the.

The memory card interface 11D is
It is composed of a serial interface and has at least three data lines. The first data line transmits a clock signal at the time of data transmission, the second data line transmits a status signal required at the time of data transmission, and the third data line serially transmits data to be written to or read from the memory card 30. I do.

When the user connects the memory card 30 to the memory card interface 11D of the personal computer 11, the CPU 11A of the personal computer 11 and the CPU 30A of the memory card 30 execute the authentication processing procedure shown in FIG. It is configured to authenticate whether a regular user who owns the memory card 30 uses the memory card 30 or not.

That is, in FIG. 5, when the user connects the memory card 30 to the personal computer 11,
The interface processing unit 11J of the personal computer 11 transmits a device ID (Identification) stored in its internal memory (not shown) to the memory card 30 via the memory card interface 11D.
The CPU 30A of the memory card 30 stores the device ID received from the personal computer 11 in a work area (not shown) of the RAM 30D.

Then, the memory card 30 proceeds to step SP1.
1, a unique device ID (ID11) of the personal computer 11 stored in the work area of the RAM 30D.
And a password unique to the user stored in the third area AR13 of the RAM 30D.
1 (FIG. 3).

For example, assuming that the device ID (ID11) of the personal computer 11 is "0001" and the password of the user is "Pass", "0001Pass" obtained by combining these is encrypted by the MD5 method. The numerical value DATA11 obtained as a result of this encryption is, for example, “efgh”.

The CPU 30A of the memory card 30
Is stored in the authentication history information D15 stored in the fifth area AR15 of the RAM 30D in step SP12, in the authentication history information D15 obtained in step SP11.
ATA11 (eg efgh) and device ID (ID1)
It is determined whether the combination with 1) exists.

Here, if a negative result is obtained, this means that the memory card 30 connected to the personal computer 11 at this time has
This indicates that there is no history connected to the personal computer 1 and the CPU 30A of the memory card 30 transmits a password input request to the personal computer 11 to the personal computer 11 via the memory card interface 11D.

CPU 11 of personal computer 11
A receives the password input request from the memory card 30 and displays a password input screen 11GA as shown in FIG. 6 on the display unit 11G, thereby displaying the password of the memory card 30 connected to the personal computer 11 at this time. The user who is the owner is prompted to input a password unique to the user.

Incidentally, C of the personal computer 11
PU 11A displays password input screen 11 on display 11G.
When displaying GA, the password input screen 11GA
In addition, the personal computer 11 displays the belonging flag input screen 11 GB together with the memory card 30.
Prompts the user to determine whether or not the user connected to is the owner of the personal computer 11.

When the user inputs a password and a belongings flag via the input unit 11H to the password input screen 11GA and the belongings flag input screen 11GB displayed on the display unit 11G, the CPU 11A of the personal computer 11 executes Moving to SP13 (FIG. 5), the password input by the user at this time and the device ID stored in advance in the interface processing unit 11J (FIG. 4) are combined, and are combined using a one-way function such as MD5. Numerical value DATA1 of the result of encryption
1 '(FIG. 5).

For example, assuming that the device ID (ID11) of the personal computer 11 is "0001" and the password input by the user is "Pass '", "0001Pass'", which is a combination of these, is set to MD.
The encryption is performed by the method of No. 5. The numerical value DATA11 'obtained as a result of this encryption is, for example, "efgh'".

The CP of the personal computer 11
U11A is a numerical value DAT generated by MD5 encryption.
A11 ′ (for example, “efgh ′”) and the belongings flag are transmitted to the memory card 30. CPU of memory card 30
30A compares the numerical value DATA11 'received from the personal computer 11 with the numerical value DATA11 generated in step SP11 in step SP14.

If the comparison result in step SP14 matches, this means that the RAM of the memory card 30
Numerical value DATA11 encrypted (MD5 encrypted) using a regular password stored in advance in 30D and numeric value DATA11 ′ encrypted (MD5 encrypted) using a password input by the user are equal to each other. This indicates that the input user is the authorized owner of the memory card 30.

Therefore, at this time, the CP of the memory card 30 is
U30D transmits a use permission signal to personal computer 11, and makes personal computer 11 usable. Then, at this time, the CPU 30D of the memory card 30 proceeds to step SP15, checks the belonging flag received from the personal computer 11, and
When the owner of the personal computer 11 has the memory card 3 connected to the personal computer 11 at this time,
If the ID matches the authorized owner of the personal computer 11, the process proceeds to step SP16.
The combination of 1) and the numerical value DATA11 having the same comparison result in step SP14 described above is stored in the memory card 3
0 in the fifth area AR15 of the RAM 30D as authentication history information D15.

On the other hand, the personal computer 1
If the owner of the personal computer 11 is not the owner of the memory card 30 connected to the personal computer 11 at this time, the information represented by the belonging flag received from
The PU 30A proceeds to step SP17, and sets the R of the combination of the personal computer 11 and the numerical value DATA11.
No new addition is made as the authentication history information D15 of the AM 30D.

As described above, the personal computer 11
The user who connected the memory card 30 to the personal computer 1 (i.e., the authorized owner of the memory card 30)
When the owner of the memory card 30 is not the owner of the memory card 30, the authentication history performed with the personal computer 11 is not newly registered as the authentication history information D15 of the RAM 30D. Only the authentication history with the owning terminal device is stored. Therefore, in this case, when the authorized owner of the memory card 30 uses the terminal device of another person, the CPU 30A of the memory card 30 always obtains a negative result in step SP12 (FIG. 5), so that the user can use the terminal device of another person. When using the terminal device, the terminal device to be used always prompts the input of the password, and the authentication process is executed.

When the user who is the authorized owner of the memory card 30 uses the terminal device owned by the user for the first time, the authentication history is not stored in the RAM 30D of the memory card 30. )
, A negative result is obtained, and the input of the password by the user and the authentication processing in step SP13 are performed. Then, in step SP15, the authentication history information is stored in the RA of the memory card 30 based on the property flag.
It is additionally stored as authentication history information D15 in the fifth area AR15 of M30D.

Thus, when the user who is the authorized owner of the memory card 30 first uses the terminal device (for example, the personal computer 11) owned by the user, the terminal device (personal computer 1) to be used is used.
The authentication process is performed with 1), and the result is stored in the RAM 30D of the memory card 30 as authentication history information.
Therefore, when the user uses the terminal device (personal computer 11) in which the authentication history information D15 is stored in the RAM 30D again, the CPU 30A of the memory card 30 connected to the terminal device is used.
Gives a positive result in step SP12 (FIG. 5). Thereby, the CPU 30A of the memory card 30 transmits an available signal to the terminal device (personal computer 11), so that the terminal device (personal computer 11) does not perform an authentication process involving input of a password by the user. The terminal device is put into a usable state.

Therefore, the user who is a regular owner of the memory card 30 connects to the terminal device which owns the memory card 30 and inputs a password only when using the terminal device for the first time, and establishes a connection with the terminal device. In contrast to executing the authentication process, the user does not need to perform the authentication process involving an operation such as input of a password for the terminal device owned by the user who has been subjected to the authentication process in the past.

In the above configuration, a password unique to the user who owns the memory card 30 is stored in the RAM 30D of the memory card 30 in advance, and the user recognizes the password in advance.

When the user connects the memory card 30 to a terminal device such as the personal computer 11, the CPU 30A of the memory card 30 obtains a device ID from the connected terminal device and encrypts the device ID together with the password stored in the RAM 30D. Become As a result, the memory card 30 generates an encrypted numerical value (MD5 numerical value) DATAx in which the device ID for specifying the terminal device to which the memory card 30 is connected and the password unique to the user who owns the memory card 30.

The combination of the encrypted numeric value DATAx and the device ID is not stored as the authentication history information D15 in the RAM 30D of the memory card 30 when the memory card 30 is first connected to the terminal device. Therefore,
The generated encrypted numerical value DATAx and device ID
Is used as the authentication history information D15 in the RAM 30D.
Does not exist, this means that the user who is the authorized owner of the memory card 30 uses the terminal device associated with the authentication history information D15 for the first time. Enter the password via the device.

As described above, only when the memory card 30 is first connected to a certain terminal device, the user himself inputs the password to the terminal device and executes the authentication processing. When the user performs authentication with the terminal device, the CPU of the memory card 30 performs the authentication process in the authentication process.
30A stores the combination of the encrypted numeric value DATAx and the device ID generated based on the password and the device ID in the RAM 30D of the memory card 30 as the authentication history information D15.

Therefore, when the encrypted numeric value DATAx and the device ID generated based on the combination of the device ID and the password are stored in the RAM 30D as the authentication history information D15, this indicates that the authorized owner of the memory card 30 Indicates that the user can use the terminal device associated with the authentication history information D15, and the user can use the terminal device only by connecting the memory card 30 to the authenticated terminal device. Become.

Therefore, the user can use the terminal device without performing a complicated authentication process such as inputting a password, and in particular, saves the trouble of inputting the password for each frequently used terminal device. Can be avoided.

Incidentally, the third party cannot know the authenticated terminal device, and the authentication history information D15 stored in the RAM 30D of the memory card 30 is also encrypted.
Unauthorized use of the terminal device by a third party is effectively prevented.
In this case, data exchanged between the memory card 30 and the terminal equipment is a numerical value DATA _x obtained by encrypting device ID and a password, these are compared with the case of exchanging unencrypted passwords and equipment ID (i.e. The plagiarism of the information indicating the authenticated terminal device) can be effectively prevented.

When the user uses a certain terminal device for the first time, the user inputs a personal property flag together with a password, and the authentication history information D1 is set only for the terminal device owned by the user.
By storing 5 in the RAM 30D of the memory card 30, the user does not need to perform an authentication process involving input of a password after the user once performs an authentication process on his / her own terminal device. On the other hand, when the user uses another person's own terminal device, the authentication history information D15 at this time is stored in the memory card
0 is not stored in the RAM 30D, so that the user performs an authentication process involving input of a password every time the terminal device of another person is used. Therefore, it is possible to distinguish a method of using the terminal device between a user who owns the terminal device and a user who does not own the terminal device.

According to the above configuration, only when the user connects the memory card 30 to a terminal device (such as the personal computer 11) associated with the authentication history information D15 stored in the memory card 30, the terminal device is connected. Since the terminal device can be used, unauthorized use of the terminal device by a third party can be effectively prevented.

When the user uses a terminal device associated with the authentication history information D15, the authentication history information D15 is used.
15 is used in the authentication process between the personal computer 11 and the memory card 30 as a result of authentication stored in the memory card 30, so that the user again uses the terminal device associated with the authentication history information D15. In such a case, an authentication process involving input of a password is not required.

Therefore, the user can easily use the terminal device by simply connecting the memory card 30 storing the authentication history information D15 to the terminal device once subjected to the authentication processing.

In the above embodiment, the case where the encrypted numeric value DATAx and the corresponding device ID (IDx) of the terminal device are stored in the RAM 30D of the memory card 30, but the present invention is not limited to this. Instead, only the encrypted numerical value DATAx may be stored. In this way, even if a third party views the data content of the RAM 30D, the device ID cannot be easily known, and unauthorized use of the terminal device due to theft of the memory card 30 can be prevented.

Incidentally, the encrypted numerical value DAT is stored in the RAM 30D.
Even when only Ax is stored, the memory card 30
CPU 30A is a numerical value DAT encrypted by combining the device ID received from the terminal device to which the memory card 30 is connected and the password stored in the RAM 30D in advance.
Ax is generated and compared with the authentication history information D15 (encrypted numerical value DATAx) stored in the RAM 30D, so that only the encrypted numerical value DATAx is stored in the RAM 30D.
, The same effect as in the above case can be obtained.

In the above-described embodiment, the case where the card-shaped memory card 30 is used as the external storage means has been described. However, the present invention is not limited to this. Can be used.

In the above embodiment, the case where the memory card 30 is connected to the personal computer 11 has been described. However, the present invention is not limited to this, and the other personal computer 12 having a memory card interface (FIG. 1) The present invention can be widely applied to various other terminal devices having a memory card interface, such as a terminal system 10B configured with a memory card 30, and a terminal system configured with a memory card.

In the above-described embodiment, the personal computer 11 encrypts the numerical value DATA obtained by encrypting the device ID and the password input by the user.
x 'is transmitted to the memory card 30, and in the memory card 30, the numerical value DATAx' is compared with the authentication history information D15 stored in the RAM 30D in advance. However, the present invention is not limited to this. 11 from the memory card 30 to the RAM 30
The authentication history information D15 (that is, the encrypted numerical value DATAx) stored in D may be read out and compared with the encrypted numerical value DATAx 'on the personal computer 11 side.

[0057]

As described above, according to the present invention, available terminal devices are stored in advance in external storage means as authentication information based on terminal device information unique to the terminal device, and the authentication information is stored. When the external storage unit is connected to a terminal device corresponding to the authentication information, the terminal device is set in a usable state based on the authentication information stored in the external storage unit, so that the terminal device having an authentication history and the external storage Only when the means is connected, the user can easily use the terminal device without performing a complicated authentication process involving input of a password.

Accordingly, unauthorized use of the terminal device by a third party can be effectively prevented while avoiding deterioration of the usability of the terminal device by an authorized user.

[Brief description of the drawings]

FIG. 1 is a schematic diagram illustrating an overall configuration of a terminal system of the present invention.

FIG. 2 is a block diagram illustrating a configuration of a memory card.

FIG. 3 is a schematic diagram illustrating a memory map of a memory card.

FIG. 4 is a block diagram illustrating a configuration of a personal computer.

FIG. 5 is a flowchart showing an authentication processing procedure between the terminal device and the external storage means.

FIG. 6 is a schematic diagram illustrating a password input screen displayed on a display unit of the terminal device in the authentication processing.

[Explanation of symbols]

10 network system, 10A, 10B terminal system, 11, 12 personal computer,
11A, 30A ... CPU, 11D ... memory card interface, 11G ... display unit, 11H ... input unit, 11J ... interface processing unit, 30 ... memory card, 30D ... RAM.

 ────────────────────────────────────────────────── ─── Continued on the front page (72) Inventor Tomohiro Tsunoda 6-35 Kita-Shinagawa, Shinagawa-ku, Tokyo F-term within Sony Corporation (reference) 5B065 BA05 CC08 CS10 EK01 EK05 PA16 5B085 AE09 AE12 AE23 5B089 GA21 KA17 KB13 KC58 KH30 MB01 MB05 MC03

Claims (9)

[Claims] In a terminal system having a terminal device and an external storage means detachable from the terminal device via a predetermined interface, an available terminal device is determined based on terminal device information unique to the terminal device. The external storage means stored in advance as authentication information; and the authentication information stored in the external storage means when the external storage means storing the authentication information is connected to the terminal device corresponding to the authentication information. A terminal device setting means for setting the terminal device to a usable state based on information. 2. When the external storage device is connected to the terminal device, an authentication process is performed between the external storage device and the terminal device, and an authenticated authentication history is stored in the external storage device as the authentication information. 2. The terminal system according to claim 1, further comprising an authentication information storage unit. 3. The authentication information storage means includes first encryption information obtained by encrypting a password input to the terminal device and terminal device information unique to the terminal device, and previously stored in the external storage device. And the second encrypted information obtained by encrypting the password and the terminal device information unique to the terminal device. When the comparison result matches, the first or second encrypted information is compared with the second encrypted information. The terminal system according to claim 2, wherein the authentication information is stored in the external storage unit. 4. An authentication method for performing authentication between a terminal device and a removable external storage means via a predetermined interface with respect to the terminal device, wherein the available terminal device is identified by the terminal device. It is stored in the external storage means in advance as authentication information based on terminal device information, and is stored in the external storage means when the external storage means storing the authentication information is connected to the terminal device corresponding to the authentication information. An authentication method, wherein the terminal device is set in a usable state based on the authentication information that has been set. 5. When the external storage means is connected to the terminal device, an authentication process is performed between the external storage means and the terminal device, and an authenticated authentication history is stored in the external storage means as the authentication information in advance. The authentication method according to claim 4, wherein the authentication method is stored. 6. A first device obtained by encrypting a password input to the terminal device and terminal device information unique to the terminal device.
The authentication processing is performed by comparing the encrypted information of the above with the second encrypted information obtained by encrypting the password stored in the external storage means and the terminal device information unique to the terminal device. And storing the first or second encrypted information in the external storage means as the authentication information when the comparison results match.
Authentication method described in. 7. An external storage device which is detachable from a terminal device via a predetermined interface, wherein the available terminal device is stored in advance as authentication information based on terminal device information unique to the terminal device, An external storage device, wherein when the terminal device is connected to the terminal device corresponding to the stored authentication information, the terminal device is set to a usable state based on the authentication information. 8. An authentication information storage means for performing an authentication process with the terminal device when connected to the terminal device and storing an authenticated authentication history as the authentication information. The external storage device according to claim 7, wherein: 9. The authentication information storage means includes first password information obtained by encrypting a password input to the terminal device and terminal device information unique to the terminal device, and pre-stored in the external storage device. And the second encrypted information obtained by encrypting the password and the terminal device information unique to the terminal device. When the comparison result matches, the first or second encrypted information is compared with the second encrypted information. The external storage device according to claim 8, wherein the external storage device stores the authentication information.